Improper input validation in Linux kernel - CVE-2026-46309

Vulnerability identifier: #VU134193

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-46309

CWE-ID: CWE-20

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to improper input validation in xe_vm_madvise_ioctl() when applying a PAT index with XE_COH_NONE to CPU cached memory. A local user can submit a crafted madvise request to disclose sensitive information.

This issue is limited to iGPU configurations, where the GPU can bypass CPU caches and read stale data directly from DRAM from previously freed pages of other processes.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-ibm (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure (Ubuntu package)
linux-aws (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 7.0.0-28.28, 7.0.0-28.28.1, 7.0.0-1003.4, 7.0.0-1008.8
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1009.9
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15

• https://git.kernel.org/stable/c/4e5591c2fc1b30f4ea5e2eab4c3a695acc404e39
• https://git.kernel.org/stable/c/87f9b1528e1ffc1da3615d552c9a06aba5e20b00
• https://git.kernel.org/stable/c/fea04cf6f2345bc50f15b6638906c35962b89424

• Improper input validation in Linux kernel drm xe driver
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux
• Ubuntu update for linux-ibm
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws